S1 Where is a Secret Image Encoded?
We further examine how and where the secret image is encoded in case of the deep learning based steganographic algorithms
as mentioned in Sec. 1. We could utilize the newly acquired discoveries to find a more appropriate way to destroy as much of
the secret image as possible while maintaining the quality of the cover image.
As illustrated in Fig. S1, after we increase the pixel value of the R channel of a random single pixel in the stego image by 1,
we evaluate its effect on the decoded secret image by measuring the residual between the secret image decoded by unmodified
stego image and randomly modified stego image, respectively. An increase by 1 in any position in any color channel of the
stego image has an impact across all color channels in the decoded secret image. We see that the largest impact commonly
occurs on the same channel.
We also witness that the secret image is encoded in a distributive but location-limited way. In other words, the pixel in-
formation of the left top corner of the secret image is only encoded on the left top corner of the cover image and likewise
for other areas. Based on this finding, we confirm that active steganalysis algorithms adjusting the stego image generated by
the deep learning-based encoding algorithms should apply the alternation of all the pixels of the stego image for the definitive
steganography removal.
Stego Image
Decoded
Secret Image
R
G
B
R
G
B
Figure S1: Impact of increasing a pixel value of the stego image by 1 on the decoded secret image. The left side of the figure is the residual
on each RGB channel between the stego image and modified stego image. The right side of the figure is the residual on each RGB channel
between the secret images decoded by the stego image and modified stego image, respectively.
S2 Ablation Study Examples
We provide a perceptual sample out of the edge condition examples of the ablation study in Table S1 in Fig. S2.
Table S1: Ablation results of our proposed methods. DC = decoded rate, and DT = destruction rate. In the case of PSNR, SSIM and DA, the
larger the value, the better. DC is the opposite.
PSNR SSIM DC DT
1 35.66 0.9834 0.7761 0.2117
Our Method w/o
Edge Detection
2 35.72 0.9837 0.7523 0.2365
4 35.39 0.9811 0.7375 0.2720
1 35.89 0.9839 0.7691 0.2184
Our
Method
2 35.85 0.9842 0.7258 0.2626
4 35.67 0.9822 0.6923 0.3001
Cover
Secret
Figure S2: Ablation study: no edge detection examples (Deep Steganography on ImageNet). S
o
= stego image, D
o
= decoded secret image,
S
NoEdge
= stego image modified by our method but without an edge condition, D
NoEdge
= secret image decoded from S
NoEdge
, S
Edge
=
stego image modified by our method with an edge condition, and D
Edge
= secret image decoded from S
Edge
S3 Comparison at the Same Decoded Rate
We provide a random sample of the examples of how our method and the conventional method, Gaussian noise, differ in the
efficiency at the same decoded rate in Fig. S3 and S4 as described in Sec. 5.1.
Cover
Secret
Figure S3: Comparison of the image quality of the stego image modified by our method with that of the stego image modified by Gaussian
noise when the decoded rate between the two secret images is the almost same (Deep Steganography on ImageNet). S
o
= stego image, D
o
= decoded secret image, S
gn
= stego image modified by Gaussian noise, D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified
by our method, and D
ps
= secret image decoded from S
ps
Cover
Secret
Figure S4: Comparison of the image quality of the stego image modified by our method with that of the stego image modified by Gaussian
noise when the decoded rate between the two secret images is the almost same (ISGAN on ImageNet). S
o
= stego image, D
o
= decoded
secret image, S
gn
= stego image modified by Gaussian noise, D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified by our
method, and D
ps
= secret image decoded from S
ps
S4 Comparison at the Same PSNR
In Fig. S5, S8, S7, S8, S9, and S10, we provide a random sample of the examples of how our method and the conventional
method, Gaussian noise, differ in the efficiency at the same PSNR for all the given cases as described in Sec. 5.1 and Fig. 4.
Cover
Secret
Figure S5: Comparison of the destructed degree of the secret image decoded by the stego image from our method with that of the
secret image decoded by the stego image from Gaussian noise when the PSNR between the two stego images is the almost same
(Deep Steganography on CIFAR-10). S
o
= stego image, D
o
= decoded secret image, S
gn
= stego image modified by Gaussian noise,
D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified by our method, and D
ps
= secret image decoded from S
ps
Cover
Secret
Figure S6: Comparison of the destructed degree of the secret image decoded by the stego image from our method with that of the secret image
decoded by the stego image from Gaussian noise when the PSNR between the two stego images is the almost same (ISGAN on CIFAR-10).
S
o
= stego image, D
o
= decoded secret image, S
gn
= stego image modified by Gaussian noise, D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified by our method, and D
ps
= secret image decoded from S
ps
Cover
Secret
Figure S7: Comparison of the destructed degree of the secret image decoded by the stego image from our method with that of the
secret image decoded by the stego image from Gaussian noise when the PSNR between the two stego images is the almost same
(Deep Steganography on ImageNet). S
o
= stego image, D
o
= decoded secret image, S
gn
= stego image modified by Gaussian noise,
D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified by our method, and D
ps
= secret image decoded from S
ps
Cover Secret
Figure S8: Comparison of the destructed degree of the secret image decoded by the stego image from our method with that of the secret image
decoded by the stego image from Gaussian noise when the PSNR between the two stego images is the almost same (ISGAN on ImageNet).
S
o
= stego image, D
o
= decoded secret image, S
gn
= stego image modified by Gaussian noise, D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified by our method, and D
ps
= secret image decoded from S
ps
Cover
Secret
Figure S9: Comparison of the destructed degree of the secret image decoded by the stego image from our method with that of the
secret image decoded by the stego image from Gaussian noise when the PSNR between the two stego images is the almost same
(Deep Steganography on BOSS1.0.1). S
o
= stego image, D
o
= decoded secret image, S
gn
= stego image modified by Gaussian noise,
D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified by our method, and D
ps
= secret image decoded from S
ps
Cover
Secret
Figure S10: Comparison of the destructed degree of the secret image decoded by the stego image from our method with that of the secret image
decoded by the stego image from Gaussian noise when the PSNR between the two stego images is the almost same (ISGAN on BOSS1.0.1).
S
o
= stego image, D
o
= decoded secret image, S
gn
= stego image modified by Gaussian noise, D
gn
= secret image decoded from S
gn
, S
ps
= stego image modified by our method, and D
ps
= secret image decoded from S
ps
